Add extended tests for CSRF attack

[phihag]

We should add extended tests for our flagship attack CSRF. In particular:

• [ ] Require some hidden fields (say, comment ID)
• [ ] HTML5 patterns, minlength etc.
• [ ] Zip codes, states, and countries
• [ ] Double passwords
• [ ] Learning from prior values